Distributed energy storage device cross-domain security access authentication method and related device

Abstract

The application belongs to the technical field of security authentication, and discloses a distributed energy storage equipment cross-domain security access authentication method and related devices, attribute information is submitted after zero-knowledge proof verification, and a verifiable credential is generated by a certificate issuing party based on a signature algorithm; then, a randomized verifiable representation based on zero-knowledge proof is generated based on the verifiable credential; finally, the energy storage equipment sends the generated randomized verifiable representation to a verification party to complete access authentication. The application realizes cross-domain authentication through a distributed architecture and a verifiable credential, and does not need to rely on a single centralized institution. The verifiable credential adopts a unified format and supports mutual recognition between different trust domains. After being randomized, the credential cannot be associated with the identity of a specific device, and anonymous authentication is realized. The verification process is realized through zero-knowledge proof, and a device can prove the legality of the identity without revealing sensitive information, thereby effectively guaranteeing the security and privacy of authentication.

Description

Technical Field

[0001] This invention belongs to the field of security authentication technology and relates to a method and related device for cross-domain secure access authentication of distributed energy storage devices. Background Technology

[0002] With the rapid development of new power systems and the energy internet, distributed energy storage, as an important means to achieve source-grid-load coordination and improve system flexibility and regulation capabilities, has been widely deployed on the user side, grid side, and in new energy access scenarios. A large number of energy storage devices with independent communication and computing capabilities are gradually connecting to the power internet of things as terminal nodes. Their cross-domain deployment characteristics place higher demands on the security of device access, the scalability of authentication, and the reliability of communication data. Against this backdrop, energy storage device authentication technology has become one of the key core technologies supporting the safe operation of distributed energy storage systems.

[0003] Currently, device access authentication mainly includes certificate-based Public Key Infrastructure (PKI) authentication, identity-based Encryption (IBE) authentication, and decentralized distributed authentication mechanisms that have emerged in recent years. PKI authentication is widely used in industrial control and power system device access scenarios, possessing a good standardization foundation and mature applications. However, due to its strong reliance on a central authority, it suffers from complex certificate management, difficult key lifecycle management, and high single-point-of-failure risk, making it difficult to meet the needs of dynamic access for distributed, large-scale devices. To reduce reliance on central certificate authorities, identity-based encryption and signature technologies have emerged, allowing users to publicly reveal their identity as a public key, thus simplifying the key distribution process to some extent. However, this solution typically relies on a Public Key Generator (PKG), facing challenges such as poor private key custody security, weak non-repudiation, and limited cross-domain deployment. In recent years, the development of blockchain technology has driven research into decentralized authentication and privacy protection mechanisms in the Internet of Things (IoT) and energy systems, attempting to minimize the disclosure of authentication information by recording identity credentials through distributed ledgers, thereby improving the system's robustness and privacy protection capabilities.

[0004] However, despite the continuous evolution of relevant authentication mechanisms, authentication methods for multi-domain collaboration, heterogeneous devices, verifiable authentication, and privacy protection still have the following main problems: (1) There is a lack of authentication framework suitable for cross-domain access of distributed energy storage devices in power systems, making it difficult to achieve mutual recognition and rapid authentication of device identities among multiple trust domains; (2) Existing certificate-based or identity-based authentication schemes have problems such as complex certificate management, high risk of single point of failure, and key escrow, making it difficult to meet the needs of flexible access of energy storage resources and further improve the ability to support collaborative scheduling; (3) Some authentication methods are difficult to guarantee anonymity, and the true identity of devices or users is easily exposed during the identity verification process, making it difficult to meet the requirements for protecting identity privacy; (4) Some authentication methods need to expose all identity attributes during transmission or verification, which poses a high risk of privacy leakage. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and related apparatus for cross-domain secure access authentication of distributed energy storage devices.

[0006] To achieve the above objectives, the present invention employs the following technical solution: In a first aspect, the present invention provides a method for cross-domain secure access authentication of distributed energy storage devices, comprising: performing zero-knowledge proof verification with an issuer, and sending attribute information to the issuer after successful verification; the attribute information is used to trigger the issuer to generate a verifiable credential based on the attribute information, a signature algorithm, and a zero-knowledge proof mechanism, and send it to the energy storage device; generating a randomized verifiable representation based on zero-knowledge proof based on the attribute information and the verifiable credential; sending the randomized verifiable representation based on zero-knowledge proof to a verifier for access authentication, and receiving the access authentication result sent by the verifier.

[0007] Optionally, the zero-knowledge proof verification with the issuing party includes: the issuing party selecting a random number based on system public parameters. As the issuing party's private key; wherein, the system public parameters ;in, Assuming prime numbers, , and All are prime numbers. cyclic group It is a bilinear mapping. , For public elements of the group For the group Generator, For the group Generator, Both are hash functions. This represents the total number of device attributes. , For model Integer multiplication group; the issuing party generates public key auxiliary parameters. The issuing party generates a zero-knowledge proof. The issuing party generates the issuing party's public key. The issuing party sends its public key to the energy storage device, which then verifies the issuing party's zero-knowledge proof using a zero-knowledge proof algorithm based on the system's public parameters and the issuing party's public key.

[0008] Optionally, the step of generating a verifiable credential based on attribute information using a signature algorithm and a zero-knowledge proof mechanism includes: the issuer selecting a random factor for the verifiable credential. , For a set of device attributes, For the first Mapping values ​​for each device attribute, Total number of device attributes; Certificate issuer calculates signature. ,in, Assign a commitment value to the device attribute and generate a verifiable credential. .

[0009] Optionally, before generating a verifiable credential based on the attribute information using a signature algorithm and a zero-knowledge proof mechanism, the method further includes: the energy storage device randomly selecting the credential holder's private key. And calculate the public key. And calculate the zero-knowledge proof of energy storage devices. The zero-knowledge proof of the energy storage device is sent to the issuing party; wherein, the zero-knowledge proof of the energy storage device is used to trigger the issuing party to verify the zero-knowledge proof of the energy storage device using a zero-knowledge proof algorithm based on the system's common parameters and obtain the verification result. When the verification result is that the verification is successful, a verifiable credential is generated based on the attribute information, the signature algorithm, and the zero-knowledge proof mechanism; otherwise, the access authentication is terminated.

[0010] Optionally, the cross-domain secure access authentication method for distributed energy storage devices further includes: the energy storage device calculating an equation... Whether the verifiable credentials are valid, and if valid, save the verifiable credentials; if invalid, terminate access authentication.

[0011] Optionally, the steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: the energy storage device randomly selecting a random factor. And calculate the randomized intermediate value. Energy storage device calculation challenge value and randomized intermediate values Energy storage devices generate randomized verifiable representations based on zero-knowledge proofs. The challenge value is then sent to the verifier for access authentication; the verifier calculates the challenge value. ; and check the formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

[0012] Optionally, the steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: the energy storage device in the attribute set Select the attributes you want to hide to form a set of hidden attributes. The set of hidden attribute indices is: , To hide attributes, the set of attribute indices for obtaining the public attributes of the energy storage device is: Committed values ​​for publicly disclosed attributes of energy storage devices. And calculate the randomized intermediate value. Random selection factor for energy storage equipment ,in, And calculate the challenge value. And calculate the randomized intermediate value. Verifiable representations of zero-knowledge proofs generated by energy storage devices The data is then sent to the verifier for access authentication; the verifier calculates... Verification formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

[0013] In a second aspect, the present invention provides a cross-domain secure access authentication system for distributed energy storage devices, comprising: a credential module, used to perform zero-knowledge proof verification with an issuer, and send attribute information to the issuer after successful verification; the attribute information is used to trigger the issuer to generate a verifiable credential based on a signature algorithm and a zero-knowledge proof mechanism according to the attribute information and send it to the energy storage device; an anonymity module, used to generate a randomized verifiable representation based on zero-knowledge proof according to the attribute information and the verifiable credential; and a verification module, used to send the randomized verifiable representation based on zero-knowledge proof to a verifier for access authentication, and to receive the access authentication result sent by the verifier.

[0014] In a third aspect, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for cross-domain secure access authentication of distributed energy storage devices.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method for cross-domain secure access authentication of distributed energy storage devices.

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention presents a cross-domain secure access authentication method for distributed energy storage devices. It achieves cross-domain authentication through a distributed architecture and verifiable credentials. These verifiable credentials can be verified in a unified format across different security domains. The verification process does not rely on a single centralized trusted institution; instead, it establishes mutual trust relationships between multiple independent management domains based on a distributed trust mechanism. Devices in different domains can verify their identity and authorize access without sharing the same trust chain, fundamentally ensuring cross-domain interoperability and achieving cross-domain identity authentication for distributed devices. This enables energy storage devices in different security domains, management domains, or trust domains to establish identity trust even in the absence of a unified trust root. The construction of verifiable credentials relies on signature algorithms and zero-knowledge proof mechanisms. Any entity without legally generated parameters cannot construct a verifiable credential, effectively preventing credential forgery and authentication process disruption, thus ensuring the security of cross-domain access for distributed energy storage devices. Meanwhile, the verifiable credentials are randomized into a randomized verifiable representation, ensuring that the verifiable credentials cannot be identifiablely associated with a specific energy storage device. During the authentication process, the legitimacy of the device's identity can be proven without disclosing its own sensitive identity information, preventing potential attackers from associating the verifiable credentials with a specific identity and achieving anonymous authentication. Furthermore, the energy storage device generates a randomized verifiable representation based on zero-knowledge proofs based on the verifiable credentials and sends it to the verifier for access authentication. This ensures the validity of the authentication while minimizing the risk of sensitive information exposure, achieving fine-grained disclosure control and privacy protection for the attributes of distributed energy storage devices. Attached Figure Description

[0017] Figure 1 This is a flowchart of a cross-domain secure access authentication method for distributed energy storage devices according to an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram illustrating an application scenario of an embodiment of the present invention.

[0019] Figure 3This is a block diagram of the cross-domain secure access authentication system for distributed energy storage devices according to an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] The present invention will now be described in further detail with reference to the accompanying drawings: See Figure 1 In one embodiment of the present invention, a cross-domain secure access authentication method for distributed energy storage devices is provided to address the challenges of identity authentication and privacy protection for energy storage devices in a multi-trust domain environment. This secure access authentication method relies on a decentralized architecture, a verifiable credential mechanism, and zero-knowledge proof technology to achieve mutual recognition of the identity and privacy protection authentication of energy storage devices across multiple trust domains.

[0023] Specifically, the cross-domain secure access authentication method for distributed energy storage devices of the present invention includes the following steps: S1: Perform zero-knowledge proof verification with the certificate issuer, and send the attribute information to the certificate issuer after successful verification; the attribute information is used to trigger the certificate issuer to generate a verifiable certificate based on the signature algorithm and zero-knowledge proof mechanism according to the attribute information and send it to the energy storage device.

[0024] S2: Generate a randomized verifiable representation based on zero-knowledge proof, using attribute information and verifiable credentials.

[0025] S3: Send the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receive the access authentication result sent by the verifier.

[0026] See Figure 2 This paper illustrates a typical application scenario of the cross-domain secure access authentication method for distributed energy storage devices according to the present invention, including the main implementing entities such as the issuing party, the energy storage device, the verifying party, and the device trust party. In this application scenario, the device trust party, as the root trust institution of the system, is responsible for initializing system parameters. The issuing party is responsible for verifying the identity attributes of the energy storage device and issuing verifiable credentials for it. The energy storage device needs to access different platforms (verifying parties) to obtain services based on the credentials issued by the issuing party. The verifying party is the target service platform, responsible for verifying the credentials submitted by the energy storage device to determine whether to allow its access. Specifically, the issuing party can be entities such as grid operators, energy regulatory departments, equipment manufacturer alliances, and large energy service providers; the verifying party can be entities such as virtual power plant operation platforms, electricity market trading platforms, microgrid management systems, and charging pile operation platforms; and the device trust party can be entities such as digital certificate authentication centers and trust root institutions established by industry alliances.

[0027] Based on the core issues of secure access authentication—identity authentication and privacy protection—the core ideas of this invention's cross-domain secure access authentication method for distributed energy storage devices are: 1. Decentralized Trust: Instead of relying on a single central authentication authority, mutual trust is established among multiple participants (issuer and verifier) ​​through cryptographic means. 2. Credential Identity: The identity and attributes of the energy storage device are encoded into verifiable credentials issued by the issuer. 3. Privacy: When presenting credentials, the energy storage device can use zero-knowledge proof technology to prove that it possesses certain qualified attributes without revealing the specific values ​​of the attributes or the original information of the credential, preventing tracking. 4. Randomization and Anti-Association: By randomizing the credentials, it ensures that credentials presented by the same energy storage device in different situations appear completely different, thereby protecting the behavioral privacy of the energy storage device.

[0028] Specifically, the present invention provides a cross-domain secure access authentication method for distributed energy storage devices. This method achieves cross-domain authentication through a distributed architecture and verifiable credentials. The verifiable credentials can be verified in a unified format across different security domains. The verification process does not rely on a single centralized trusted institution; instead, it establishes mutual trust relationships between multiple independent management domains based on a distributed trust mechanism. Devices in different domains can verify their identity and authorize access without sharing the same trust chain, fundamentally ensuring cross-domain interoperability and achieving cross-domain identity authentication for distributed devices. This enables energy storage devices in different security domains, management domains, or trust domains to establish identity trust even in the absence of a unified trust root. The construction of verifiable credentials relies on signature algorithms and zero-knowledge proof mechanisms. Any entity without legally generated parameters cannot construct a verifiable credential, effectively preventing credential forgery and disruption of the authentication process, thus ensuring the security of cross-domain access for distributed energy storage devices. Simultaneously, verifiable credentials are randomized into randomized verifiable credentials, ensuring that these credentials cannot be identifiablely associated with any specific energy storage device. During authentication, the legitimacy of the device's identity can be proven without disclosing sensitive personal information, preventing potential attackers from associating verifiable credentials with specific identities and achieving anonymous authentication. Furthermore, the energy storage device generates a verifiable representation based on zero-knowledge proofs using the randomized verifiable credentials and sends it to the verifier for access authentication. This ensures authentication effectiveness while minimizing the risk of sensitive information exposure, achieving fine-grained disclosure control and privacy protection for distributed energy storage device attributes.

[0029] In one possible implementation, the zero-knowledge proof verification with the issuing party includes: the issuing party selecting a random number based on system public parameters. As the issuing party's private key; wherein, the system public parameters ;in, Assuming prime numbers, , and All are prime numbers. cyclic group It is a bilinear mapping. , For public elements of the group For the group Generator, For the group Generator, Both are hash functions. , This represents the total number of device attributes. , For model Integer multiplication group; the issuing party generates public key auxiliary parameters. The issuing party generates a zero-knowledge proof. The issuing party generates the issuing party's public key. The issuing party sends its public key to the energy storage device, which then verifies the issuing party's zero-knowledge proof using a zero-knowledge proof algorithm based on the system's public parameters and the issuing party's public key.

[0030] Explanatoryly, during the preparation phase for cross-domain secure access authentication of distributed energy storage devices, the trusted party of the device can initialize the system's common parameters, including selecting a secure bilinear group, setting a hash function, and constructing a bilinear mapping relationship, with the goal of establishing the cryptographic foundation for the entire system's operation.

[0031] Among them, the preset prime number It is prime numbers of bits This is a security parameter (e.g., 256), which determines the level of cryptographic strength. Bilinear mapping. This means for all and all integers ,satisfy: For example, in elliptic curve cryptography, and It is a subgroup on an elliptic curve. It is a multiplicative subgroup in a finite field.

[0032] During the interactive verification between the energy storage device and the issuing party, the issuing party constructs the auxiliary parameters and proof structure required for issuing verifiable credentials based on its own generated key information. Specifically, the issuing party computes a non-interactive zero-knowledge proof, i.e., the issuing party's zero-knowledge proof. This is used to prove to energy storage devices that the issuer indeed possesses the public key parameters. and the corresponding private key .in, For non-interactive zero-knowledge proofs, the specific process can be implemented based on the Fiat-Shamir heuristic.

[0033] In one possible implementation, generating a verifiable credential based on attribute information using a signature algorithm and a zero-knowledge proof mechanism includes: the issuer selecting a random factor for the verifiable credential. , For a set of device attributes, For the first Mapping values ​​for each device attribute, Total number of device attributes; Certificate issuer calculates signature. ,in, Assign a commitment value to the device attribute and generate a verifiable credential. .

[0034] Explained, during the certificate generation phase, the energy storage device obtains a verifiable certificate corresponding to its attributes by interacting with the certificate issuer. This verifiable certificate is issued by the certificate issuer based on the information submitted by the energy storage device and incorporates necessary security parameters and random factors to ensure the certificate's authenticity, integrity, and anti-counterfeiting capabilities.

[0035] In one possible implementation, before generating a verifiable credential based on attribute information using a signature algorithm and a zero-knowledge proof mechanism, the method further includes: the energy storage device randomly selecting the credential holder's private key. And calculate the public key. And calculate the zero-knowledge proof of energy storage devices. The zero-knowledge proof of the energy storage device is sent to the issuing party; wherein, the zero-knowledge proof of the energy storage device is used to trigger the issuing party to verify the zero-knowledge proof of the energy storage device using a zero-knowledge proof algorithm based on the system's common parameters and obtain the verification result. When the verification result is that the verification is successful, a verifiable credential is generated based on the attribute information, the signature algorithm, and the zero-knowledge proof mechanism; otherwise, the access authentication is terminated.

[0036] For explanatory purposes, before generating verifiable credentials, the issuing party needs to verify the energy storage device. This is achieved using zero-knowledge proof verification, protecting the privacy of the energy storage device. The main process at this stage involves the energy storage device generating a zero-knowledge proof and sending it to the issuing party for verification.

[0037] In one possible implementation, the distributed energy storage device cross-domain secure access authentication method further includes: the energy storage device calculating an equation... Whether the verifiable credentials are valid, and if valid, save the verifiable credentials; if invalid, terminate access authentication.

[0038] Explanatoryly, after receiving verifiable credentials, the energy storage device utilizes bilinearity to calculate equations. This is used to verify the validity of the verifiable credentials and ensure that the verifiable credentials are valid.

[0039] In one possible implementation, the steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: the energy storage device randomly selecting a random factor. And calculate the randomized intermediate value. Energy storage device calculation challenge value and randomized intermediate values Energy storage devices generate randomized verifiable representations based on zero-knowledge proofs. The challenge value is then sent to the verifier for access authentication; the verifier calculates the challenge value. ; and check the formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

[0040] For example, the verifier checks the formula and If the condition is not met, the verifier outputs 0, indicating that the access has terminated, the verifiable representation is invalid, and the energy storage device fails authentication; otherwise, it outputs 1, indicating that the verifiable representation is valid and the energy storage device passes authentication.

[0041] Explained, for an energy storage device to securely access a platform (the verifier) ​​and access specific services, it needs to generate and provide a verifiable representation to the verifier to prove that the energy storage device meets specific attribute requirements. In this embodiment, based on the verifiable credentials, the energy storage device generates a randomized verifiable representation based on zero-knowledge proof through a zero-knowledge proof mechanism and sends it as an authentication request to the verifier. After receiving the authentication request submitted by the energy storage device, the verifier verifies the validity of the verifiable representation and the attribute proof based on the system's publicly available parameters and the system's established verification logic. If the verification passes, the energy storage device is allowed to access; if the verification fails, the energy storage device's access is rejected, ensuring the overall security of the system.

[0042] In one possible implementation, the steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: the energy storage device in the attribute set Select the attributes you want to hide to form a set of hidden attributes. The set of hidden attribute indices is: , To hide attributes, the set of attribute indices for obtaining the public attributes of the energy storage device is: Committed values ​​for publicly disclosed attributes of energy storage devices. And calculate the randomized intermediate value. Random selection factor for energy storage equipment ,in, And calculate the challenge value. And calculate the randomized intermediate value. Verifiable representations of zero-knowledge proofs generated by energy storage devices The data is then sent to the verifier for access authentication; the verifier calculates... Verification formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

[0043] Explanatoryly, when an energy storage device needs to connect to a target verification party, the device can selectively disclose some attributes according to its own privacy protection needs and send the disclosed attributes to the verification party for validity verification; for attributes not specified in the disclosure requirements, their validity is verified through zero-knowledge proof, so as to ensure the validity of authentication while minimizing the risk of exposure of sensitive information, and realize fine-grained disclosure control and privacy protection.

[0044] In summary, the cross-domain secure access authentication method for distributed energy storage devices of the present invention has the following characteristics: 1. Cross-Domain Authentication. This invention enables cross-domain authentication for distributed energy storage devices, allowing devices located in different security domains, management domains, or trust domains to establish identity trust in the absence of a unified root of trust. This invention achieves cross-domain authentication through a distributed architecture and verifiable credentials. These verifiable credentials can be verified in a unified format across different security domains. The verification process does not rely on a single centralized trusted institution; instead, it establishes mutual trust relationships between multiple independent management domains based on a distributed trust mechanism. Energy storage devices in different domains can verify identity legitimacy and authorize access without sharing the same root of trust, fundamentally ensuring cross-domain interoperability and achieving cross-domain identity authentication for distributed devices.

[0045] 2. Anonymous Authentication. This invention enables anonymous authentication of distributed energy storage devices, allowing these devices to prove their identity without disclosing sensitive information. The generation process of verifiable credentials does not directly expose any identity information that could bind the credential holder to the credential. Furthermore, the credential holder's identity identifier is randomized, ensuring that verifiable credentials cannot be identifiablely associated with a specific device identity. Therefore, potential attackers cannot associate verifiable credentials with a specific identity, thus satisfying the requirement for anonymous device authentication.

[0046] 3. Verifiable credentials are unforgeable. Verifiable credentials are unforgeable, meaning that no entity without valid generation parameters can construct a valid credential. The construction of verifiable credentials relies on BBS signatures based on bilinear groups, randomized signatures, and non-interactive zero-knowledge proofs. Because BBS signatures satisfy the unforgeability requirement, randomized signatures provide security, and non-interactive zero-knowledge proofs guarantee correctness, it ensures that no attacker can forge credentials or disrupt the authentication process, thus achieving the unforgeability of verifiable credentials.

[0047] 4. Selective Disclosure of Device Attributes. This invention supports the selective disclosure of energy storage device attributes. During the certification process, energy storage devices selectively disclose specific attributes as needed, while keeping other attributes confidential, thereby protecting privacy and reducing the risk of information exposure. The energy storage device can generate a randomized verifiable representation based on the selectively disclosed attributes. For disclosed attributes, the holder calculates to further prove their validity; for undisclosed attributes, the holder uses zero-knowledge proofs to prove their validity.

[0048] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0049] See Figure 3 In another embodiment of the present invention, a cross-domain secure access authentication system for distributed energy storage devices is provided, which can be used to implement the above-mentioned cross-domain secure access authentication method for distributed energy storage devices. Specifically, the cross-domain secure access authentication system for distributed energy storage devices includes a credential module, an anonymity module, and a verification module.

[0050] The certificate module is used to perform zero-knowledge proof verification with the certificate issuer and send attribute information to the certificate issuer after successful verification. The attribute information is used to trigger the certificate issuer to generate a verifiable certificate based on the attribute information, signature algorithm and zero-knowledge proof mechanism and send it to the energy storage device. The anonymity module is used to generate a randomized verifiable representation based on zero-knowledge proof based on the attribute information and verifiable certificate. The verification module is used to send the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication and to receive the access authentication result sent by the verifier.

[0051] In one possible implementation, the zero-knowledge proof verification with the issuing party includes: the issuing party selecting a random number based on system public parameters. As the issuing party's private key; wherein, the system public parameters ;in, Assuming prime numbers, , and All are prime numbers. cyclic group It is a bilinear mapping. , For public elements of the group For the group Generator, For the group Generator, Both are hash functions. ; , For model Integer multiplication group; the issuing party generates public key auxiliary parameters. The issuing party generates a zero-knowledge proof. The issuing party generates the issuing party's public key. The issuing party sends its public key to the energy storage device, which then verifies the issuing party's zero-knowledge proof using a zero-knowledge proof algorithm based on the system's public parameters and the issuing party's public key.

[0052] In one possible implementation, generating a verifiable credential based on attribute information using a signature algorithm and a zero-knowledge proof mechanism includes: the issuer selecting a random factor for the verifiable credential. , For a set of device attributes, For the first Mapping values ​​for each device attribute, Total number of device attributes; Certificate issuer calculates signature. ,in, Assign a commitment value to the device attribute and generate a verifiable credential. .

[0053] In one possible implementation, before generating a verifiable credential based on attribute information using a signature algorithm and a zero-knowledge proof mechanism, the method further includes: the energy storage device randomly selecting the credential holder's private key. And calculate the public key. And calculate the zero-knowledge proof of energy storage devices. The zero-knowledge proof of the energy storage device is sent to the issuing party; wherein, the zero-knowledge proof of the energy storage device is used to trigger the issuing party to verify the zero-knowledge proof of the energy storage device using a zero-knowledge proof algorithm based on the system's common parameters and obtain the verification result. When the verification result is that the verification is successful, a verifiable credential is generated based on the attribute information, the signature algorithm, and the zero-knowledge proof mechanism; otherwise, the access authentication is terminated.

[0054] In one possible implementation, the distributed energy storage device cross-domain secure access authentication method further includes: the energy storage device calculating an equation... Whether the verifiable credentials are valid, and if valid, save the verifiable credentials; if invalid, terminate access authentication.

[0055] In one possible implementation, the steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: the energy storage device randomly selecting a random factor. And calculate the randomized intermediate value. Energy storage device calculation challenge value and randomized intermediate values Energy storage devices generate randomized verifiable representations based on zero-knowledge proofs. The challenge value is then sent to the verifier for access authentication; the verifier calculates the challenge value. ; and check the formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

[0056] In one possible implementation, the steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: the energy storage device in the attribute set Select the attributes you want to hide to form a set of hidden attributes. The set of hidden attribute indices is: , To hide attributes, the set of attribute indices for obtaining the public attributes of the energy storage device is: Committed values ​​for publicly disclosed attributes of energy storage devices. And calculate the randomized intermediate value. Random selection factor for energy storage equipment ,in, And calculate the challenge value. And calculate the randomized intermediate value. Verifiable representations of zero-knowledge proofs generated by energy storage devices The data is then sent to the verifier for access authentication; the verifier calculates... Verification formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

[0057] All relevant content of each step involved in the aforementioned embodiments of the cross-domain secure access authentication method for distributed energy storage devices can be referenced from the functional description of the corresponding functional module of the cross-domain secure access authentication system for distributed energy storage devices in the embodiments of the present invention, and will not be repeated here.

[0058] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0059] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to achieve corresponding method flows or corresponding functions. The processor described in this embodiment of the present invention can be used for the operation of a cross-domain secure access authentication method for distributed energy storage devices.

[0060] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the cross-domain secure access authentication method for distributed energy storage devices in the above embodiments.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for cross-domain secure access authentication of distributed energy storage devices, characterized in that, include: Perform zero-knowledge proof verification with the issuing authority, and send the attribute information to the issuing authority after the verification is successful; The attribute information is used to trigger the certificate issuer to generate a verifiable certificate based on the attribute information, a signature algorithm, and a zero-knowledge proof mechanism, and send it to the energy storage device. Based on attribute information and verifiable credentials, generate a randomized verifiable representation based on zero-knowledge proof; The randomized verifiable representation based on zero-knowledge proof is sent to the verifier for access authentication, and the access authentication result is received from the verifier. The zero-knowledge proof verification with the issuing party includes: The issuing party selects a random number based on the system's common parameters. As the issuing party's private key; wherein, the system public parameters ;in, Assuming prime numbers, , and All are prime numbers. cyclic group It is a bilinear mapping. , For public elements of the group For the group Generator, For the group Generator, Both are hash functions. ; This represents the total number of device attributes. , For model Integer multiplication group; the issuing party generates public key auxiliary parameters. The issuing party generates a zero-knowledge proof. The issuing party generates the issuing party's public key. ; The issuing party sends its public key to the energy storage device, which then verifies the issuing party's zero-knowledge proof using a zero-knowledge proof algorithm based on the system's public parameters and the issuing party's public key. The process of generating verifiable credentials based on attribute information using signature algorithms and zero-knowledge proof mechanisms includes: The issuing party selects a verifiable certificate random factor. , A set of device attributes For the first Mapping values ​​for each device attribute, This represents the total number of device attributes. The issuing party calculates the signature. ,in, Assign a commitment value to the device attribute and generate a verifiable credential. ; Before generating a verifiable credential based on attribute information using a signature algorithm and zero-knowledge proof mechanism, the process also includes: Energy storage devices randomly select the private key of the credential holder. And calculate the public key. And calculate the zero-knowledge proof of energy storage devices. The zero-knowledge proof of the energy storage device is sent to the issuing party; wherein, the zero-knowledge proof of the energy storage device is used to trigger the issuing party to verify the zero-knowledge proof of the energy storage device using a zero-knowledge proof algorithm based on the system's common parameters and obtain the verification result. When the verification result is that the verification is successful, a verifiable credential is generated based on the attribute information, the signature algorithm, and the zero-knowledge proof mechanism; otherwise, the access authentication is terminated. The cross-domain secure access authentication method for distributed energy storage devices also includes: Energy storage devices are calculated using equations Whether the verifiable credentials are valid, and if valid, save the verifiable credentials; if invalid, terminate access authentication. The steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: Energy storage devices randomly select random factors And calculate the randomized intermediate value. Energy storage device calculation challenge value and randomized intermediate values Energy storage devices generate randomized verifiable representations based on zero-knowledge proofs. And send it to the verification party for access authentication; The verifier calculates the challenge value. ; and check the formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

2. The cross-domain secure access authentication method for distributed energy storage devices according to claim 1, characterized in that, The steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: Energy storage devices in attribute set Select the attributes you want to hide to form a set of hidden attributes. The set of hidden attribute indices is: , To hide attributes, the set of attribute indices for obtaining the public attributes of the energy storage device is: Committed values ​​for publicly disclosed attributes of energy storage devices. And calculate the randomized intermediate value. Random selection factor for energy storage equipment ,in, And calculate the challenge value. And calculate the randomized intermediate value. Verifiable representations of zero-knowledge proofs generated by energy storage devices And send it to the verification party for access authentication; Verification calculation Verification formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

3. A cross-domain secure access authentication system for distributed energy storage devices, characterized in that, include: The credential module is used to perform zero-knowledge proof verification with the certificate issuer and send the attribute information to the certificate issuer after successful verification. The attribute information is used to trigger the certificate issuer to generate a verifiable certificate based on the attribute information, a signature algorithm, and a zero-knowledge proof mechanism, and send it to the energy storage device. Anonymous module is used to generate randomized verifiable representations based on zero-knowledge proofs, based on attribute information and verifiable credentials. The verification module is used to send a randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and to receive the access authentication result sent by the verifier. The zero-knowledge proof verification with the issuing party includes: The issuing party selects a random number based on the system's common parameters. As the issuing party's private key; wherein, the system public parameters ;in, Assuming prime numbers, , and All are prime numbers. cyclic group It is a bilinear mapping. , For public elements of the group For the group Generator, For the group Generator, Both are hash functions. ; This represents the total number of device attributes. , For model Integer multiplication group; the issuing party generates public key auxiliary parameters. The issuing party generates a zero-knowledge proof. The issuing party generates the issuing party's public key. ; The issuing party sends its public key to the energy storage device, which then verifies the issuing party's zero-knowledge proof using a zero-knowledge proof algorithm based on the system's public parameters and the issuing party's public key. The process of generating verifiable credentials based on attribute information using signature algorithms and zero-knowledge proof mechanisms includes: The issuing party selects a verifiable certificate random factor. , A set of device attributes For the first Mapping values ​​for each device attribute, This represents the total number of device attributes. The issuing party calculates the signature. ,in, Assign a commitment value to the device attribute and generate a verifiable credential. ; Before generating a verifiable credential based on attribute information using a signature algorithm and zero-knowledge proof mechanism, the process also includes: Energy storage devices randomly select the private key of the credential holder. And calculate the public key. And calculate the zero-knowledge proof of energy storage devices. The zero-knowledge proof of the energy storage device is sent to the issuing party; wherein, the zero-knowledge proof of the energy storage device is used to trigger the issuing party to verify the zero-knowledge proof of the energy storage device using a zero-knowledge proof algorithm based on the system's common parameters and obtain the verification result. When the verification result is that the verification is successful, a verifiable credential is generated based on the attribute information, the signature algorithm, and the zero-knowledge proof mechanism; otherwise, the access authentication is terminated. The cross-domain secure access authentication method for distributed energy storage devices also includes: Energy storage devices are calculated using equations Whether the verifiable credentials are valid, and if valid, save the verifiable credentials; if invalid, terminate access authentication. The steps of generating a randomized verifiable representation based on zero-knowledge proof according to attribute information and verifiable credentials, sending the randomized verifiable representation based on zero-knowledge proof to the verifier for access authentication, and receiving the access authentication result sent by the verifier include: Energy storage devices randomly select random factors And calculate the randomized intermediate value. Energy storage device calculation challenge value and randomized intermediate values Energy storage devices generate randomized verifiable representations based on zero-knowledge proofs. And send it to the verification party for access authentication; The verifier calculates the challenge value. ; and check the formula and If the authentication is successful, the access authentication result is considered successful; otherwise, the access authentication result is considered unsuccessful. The authenticator will then send the access authentication result to the energy storage device.

4. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the cross-domain secure access authentication method for distributed energy storage devices as described in any one of claims 1 to 2.

5. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the cross-domain secure access authentication method for distributed energy storage devices as described in any one of claims 1 to 2.

Images